Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

8 points

I cannot log in to a MAC 10.5.8 and File Vault was NOT turned on.

Dear Mac Experts:

I know that there are many pages of information about using, remembering and managing passwords. I have read most of them.I know the passwords and File Vault was not on. I am working at someone's home on their computer and running their business. The computer is running MAC 10.5.8 and I don't know if it can be updated. The computer had an Admin account and no user accounts. I tried to change this so the compuer would be secure but my client did not want to. When I left yesterday the computer was fine. When I came in today there were a number of apps hanging. I forced quit Firefox and some other apps and logged out an shut down the computer. When I tried to log into the Admin Account which is the main user account I got the error messages below:

Your FileVault-protected home folder did not open and needs to be repaired.

click ok to repair the folder and continue logging in.

I clicked ok

then I got a new error message:

You are unable to log in to the user account "x" at this time because and error occured.

Clicked OK

File Vault was not turned on at anytime that I know of in the last couple of months. I luckily had a guest user set up and logged in as guest. In order to create another Admin account I had to use the password for the initial Admin main user account which unlocked the preferences pane and allowed me to create a new Admin Account.

Checked that FileVault was turned off.

After reading all of your comments and suggestions for the last 2 hours my head is spinning.

I don't know unix or type commands. I don't know where the install discs are.

As the new Admin I went into the keychain files and tried to verify and repair the original Admin's info.

Here is what I got:

Verification started

Checking keychain configuration for Susan F (user ID=501)

Home directory is /Users/suero

Checked login keychain

Error: login keychain not found

Unable to get info for ~/Library/Keychains/login.keychain, reason: No such file or directory

Checked password for ~/Library/Keychains/login.keychain

Unable to verify password for ~/Library/Keychains/login.keychain (-25294)

Unable to read settings for ~/Library/Keychains/login.keychain (-25294)

Checked default keychain

Problems were found; you should choose the Repair option to fix them

Verification failed

Repair started

Checking keychain configuration for Susan F (user ID=501)

Home directory is /Users/suero

Checked login keychain

Error: login keychain not found

Warning: some problems were not fixed

Repair failed

The machine is backed up onto a lacie external hard drive every hour.

In addition, while I was poking around I found the following:

com.apple.kerberos.kdc certificate

not trusted

com.apple.systemdefault certificate

not trusted

Could there be some malware at work? What can I do to get her files, home directory and everything back?

Thank you in advance for your patience with an old OS and a MAC user who does't feel comfortable mucking around under the hood.

Tracy

Message was edited by: TracyCV

iMac, Mac OS X (10.5.8), 2.4 Intel Core Duo 2external backup

Posted on Aug 23, 2013 6:54 PM

Best reply

BDAqua

Level 10

239,279 points

Posted on Aug 23, 2013 8:40 PM

Hi Tracy,

I don't suspect Malware yet, Id guess Disk corruption or failing Hard Drive with Files not found.

Could be many things, we should start with this...

"Try Disk Utility

1. Insert the Mac OS X Install disc, then restart the computer while holding the C key.

2. When your computer finishes starting up from the disc, choose Disk Utility from the Installer menu at top of the screen. (In Mac OS X 10.4 or later, you must select your language first.)

*Important: Do not click Continue in the first screen of the Installer. If you do, you must restart from the disc again to access Disk Utility.*

3. Click the First Aid tab.

4. Select your Mac OS X volume.

5. Click Repair Disk, (not Repair Permissions). Disk Utility checks and repairs the disk."

http://docs.info.apple.com/article.html?artnum=106214

Then try a Safe Boot, (holding Shift key down at bootup), run Disk Utility in Applications>Utilities, then highlight your drive, click on Repair Permissions, reboot when it completes.

(Safe boot may stay on the gray radian for a long time, let it go, it's trying to repair the Hard Drive.)

If perchance you can't find your install Disc, at least try it from the Safe Boot part onward.

View in context

60 replies

TracyCV Author

Level 1

8 points

Aug 26, 2013 5:34 PM in response to BDAqua

I went back through your suggestions and did a safe mode boot and got error messages that did not appear the last time I did it.

Verifying volume “MAC”

Performing live verification.

Checking Journaled HFS Plus volume.

Checking Extents Overflow file.

Checking Catalog file.

Incorrect number of thread records

Checking multi-linked files.

Checking Catalog hierarchy.

Checking Extended Attributes file.

Checking volume bitmap.

Checking volume information.

The volume MAC needs to be repaired.

Error: Filesystem verify or repair failed.

What should do now?

TracyCV Author

Level 1

8 points

Aug 26, 2013 6:05 PM in response to Pondini

Dear Pondini:

The stuff I just posted happened when I did a Verify Disk from the new Admin. On the MAC HD.

then I got a message saying verify stopped.

Somehow File Vault got turned on but not by me. I never use it.

It locked the home directory and in the provess locked the back up files. I tried changing the master password and then reseting the passowrds and that when all this started:-(

I realize that the computer is old and out of date and I had just started to find out if the machine could be updated to accomodate a new os but it would need more memory or ram or something. The computer is used for email and facebook and some basic docs and lots of pitctures and the LACIE back up was gonna save all this from happening.

I relly don't want her to lose years of her family history.

I repaired the permissions again on the MAC HD and now I am running another Verify Disk. It just finished and there were no issues so the repair disk button stayed greyed out. HAs anyone ever "fixed file vault?

tracy

TracyCV Author

Level 1

8 points

Aug 26, 2013 6:22 PM in response to Pondini

Now I understand, I think.

My tree looks like this in Disk Repair:

Hitachi HD

MAC HD

LaCie

Lacie

BTW I just did a get info on LaCie and there are 2 partitions in there and they have diffferent permissions.

I know nothing about hd and partitions.

As to the sparcebundle file i can do what you said.

I just wonder if there is a way to get into Lacie that is not locked by File VAult and save us the trouble of trying to fix the HD.

tracy

Pondini

Level 8

38,863 points

Aug 26, 2013 6:25 PM in response to TracyCV

TracyCV wrote:

. . .

The stuff I just posted happened when I did a Verify Disk from the new Admin. On the MAC HD.

Then you need to start by Repairing it, by starting from another source, such as the Leopard Install disk, as you would with any disk.

That's unlikely to be the problem with the sparse bundle, though. As posted, it has it's own format, directories, etc., and verifying or repairing the disk it's on won't touch the innards. Do you know how a sparse bundle works?

Somehow File Vault got turned on but not by me. I never use it.

It doesn't matter. It was on. And if nobody has a password, the data is not recoverable. Period. That's kinda the point of encryption, isn't it?

It locked the home directory and in the provess locked the back up files.

The home directory is inside the sparse bundle. If by "locked" you mean nobody has permission to read it, then yes, that's the point of encrypting it.

I tried changing the master password and then reseting the passowrds and that when all this started:-(

Sounds like it had already started, and that may have made it worse.

I relly don't want her to lose years of her family history.

It's probably already hopeless. We haven't even looked at the backups yet, so there's still a possibility.

I repaired the permissions again on the MAC HD

That only works on files installed by the OSX installer: About Disk Utility's Repair Disk Permissions feature

and now I am running another Verify Disk.

It just finished and there were no issues so the repair disk button stayed greyed out.

It will always be grayed-out for the disk it's running from. DU can do a "live verify" but not a "live repair." As above, you must start from another source to Repair.

But again, that doesn't touch the innards of the sparse bundle.

HAs anyone ever "fixed file vault?

Sometimes, if they know what they're doing.

Forgive me, but you seem to be in wayyy over your head here. Please try the Genius Bar.

TracyCV Author

Level 1

8 points

Aug 26, 2013 6:26 PM in response to Pondini

I grabbed the sparcebundle and put it into Disck Utility but it wants the passwords that I don't have to access sparcebundle. and even if I did there only seems to be 204 bytes on disk.

tracy

Pondini

Level 8

38,863 points

Aug 26, 2013 6:32 PM in response to TracyCV

TracyCV wrote:

Now I understand, I think.

My tree looks like this in Disk Repair:

Hitachi HD

MAC HD

LaCie

Lacie

BTW I just did a get info on LaCie and there are 2 partitions in there and they have diffferent permissions.

I know nothing about hd and partitions.

Clearly. 😟

From your description, there's only one partition on each drive. Here's what two drives, each with multiple partitions, look like:

I just wonder if there is a way to get into Lacie that is not locked by File VAult

It's probably not locked, but the backed-up copy is certainly encrypted and protected by the same permissions as on the internal HD. Again, that's the whole point of encryption. So without the password, the backups are toast.

Pondini

Level 8

38,863 points

Aug 26, 2013 6:39 PM in response to TracyCV

TracyCV wrote:

I grabbed the sparcebundle and put it into Disck Utility but it wants the passwords that I don't have to access sparcebundle.

Yes, of course it does. You need the password to access the data.

and even if I did there only seems to be 204 bytes on disk.

OSX won't show the size of something the logged-on user doesn't have read rights for.

Forgive me again, but you might consider a refresher course in OSX.

Botttom line: Somebody turned FileVault on and nobody has the password. The data is gone.

TracyCV Author

Level 1

8 points

Aug 26, 2013 6:40 PM in response to Pondini

I think you are correct. I thought that 10.5 was before snow lepard. And that is as far as she can update with the machine as is.?

thank you.

Pondini

Level 8

38,863 points

Aug 26, 2013 6:46 PM in response to TracyCV

TracyCV wrote:

I think you are correct. I thought that 10.5 was before snow lepard.

Leopard is 10.5, Snow Leopard 10.6.

And that is as far as she can update with the machine as is.?

The HD needs to be reformatted anyway.

If it's a PPC Mac, Leopard is as far as it can go.

If it's an Intel, it depends on what model.

TracyCV Author

Level 1

8 points

Aug 26, 2013 7:10 PM in response to Pondini

I appreciate your frank reply. Could you answer one more thing before I say good night?

There is a FileVault Recovery key in the keychain access folder that has a cerificate that is listed as not to be trusted from 2010 that came through sbcglobal.net

any chance that could be part of the problem?

since I know most of the old passwords that have been used on this machine I unlocked the FileVault Master Pasword Key.

Logging out and shutting down and getting out of safemode and tryung one more time to get into the old user.

Good night

TracyCV Author

Level 1

8 points

Aug 26, 2013 7:16 PM in response to Pondini

Thank you I will check when it restarts and see if it is a ppc or not

It is an intel 2.4 ghz Intel Core 2 duo

1 gig 800 MHz DDR2 SDRAM

Pondini

Level 8

38,863 points

Aug 26, 2013 7:18 PM in response to TracyCV

TracyCV wrote:

. . .

There is a FileVault Recovery key in the keychain access folder that has a cerificate that is listed as not to be trusted from 2010 that came through sbcglobal.net

any chance that could be part of the problem?

Could be, but I don't know, and Apple has removed most of the old support articles. Try searching for Legacy File Vault here: http://support.apple.com/kb/index?page=search&locale=en_US&q=

Pondini

Level 8

38,863 points

Aug 26, 2013 7:24 PM in response to TracyCV

TracyCV wrote:

Thank you I will check when it restarts and see if it is a ppc or not

It is an intel 2.4 ghz Intel Core 2 duo

1 gig 800 MHz DDR2 SDRAM

Mac OS X v10.6 Snow Leopard - Technical Specifications

TracyCV Author

Level 1

8 points

Aug 26, 2013 7:27 PM in response to Pondini

So can "I" not me a computer store:-) add 5 gig or should she get a new computer?

Pondini

Level 8

38,863 points

Aug 26, 2013 7:40 PM in response to TracyCV

You cannot be serious. I'm done here.

I cannot log in to a MAC 10.5.8 and File Vault was NOT turned on.